E-Signatures Under HIPAA and FDA 21 CFR Part 11

"HIPAA-compliant e-signature" and "Part 11-compliant e-signature" sound like the same question. They are not. One is about who may hold patient data; the other is about how a signature on an FDA-regulated record must be built. Buying for the wrong one is the expensive mistake here, so this page separates them before naming a tool.

No software is HIPAA- or Part 11-compliant on its own. Compliance belongs to the practice or the regulated company, through its contracts, settings and procedures. What a vendor can do is sign the right agreement and ship the controls you need.

HIPAA: the agreement matters more than the signature

The HIPAA Security Rule that HHS finalized in 2003 adopted security standards only; the proposed electronic-signature standard was set aside for a later rule. The one exception today is narrow: a final rule published March 24, 2026 (effective May 26, 2026, compliance required by May 26, 2028) adopts an electronic-signature standard, HL7's Digital Signatures Guide, only for health care claims attachments transactions sent to health plans (45 CFR 162.2002(e)). For intake forms, consents and other patient paperwork, HIPAA does not tell you what an e-signature must look like.

What it does decide is the vendor relationship. A business associate is anyone who creates, receives, maintains or transmits protected health information on behalf of a covered entity (45 CFR 160.103). An e-signature service storing signed patient forms fits that description. A covered entity may disclose patient information to a business associate only with satisfactory assurance that it will safeguard it, documented in a written contract or agreement (45 CFR 164.502(e)): in practice, a signed business associate agreement (BAA) before patient data goes in.

The vendors' own terms differ more than their marketing:

FDA Part 11: the signature itself is regulated

If you sign records that FDA regulations require (batch records, clinical trial documents, quality approvals), 21 CFR Part 11 applies, and it is specific:

• Manifestation (§ 11.50). The signed record must show the signer's printed name, the date and time, and the meaning of the signature, such as review, approval or authorship, including on any printout.
• Linking (§ 11.70). Signatures must be linked to their records so they cannot be cut, copied or transferred to falsify another record.
• Uniqueness and identity (§ 11.100). Each signature belongs to one person and is never reused or reassigned, and the organization verifies identity before assigning it.
• Certification to FDA (§ 11.100(c)). The company certifies to the agency that its electronic signatures are the legally binding equivalent of handwritten ones, in a letter signed by hand.
• Two components (§ 11.200). Non-biometric signatures use at least two distinct identification components, such as an ID code and a password, with all components required at the first signing of a session.

A general-purpose e-signature plan may not give you these by default. You need a product built for them and your own validation.

Our picks

• Part 11 work: Docusign. Docusign sells a Part 11 module that adds two-factor authentication to access and sign, a reason-for-signing choice and a Certificate of Completion for each transaction, plus a separate validation module. It is the only Part 11 offer documented in the sources this page cites. Skip it if your quality system already lives in a PDF-centered document workflow: then start the same Part 11 checklist with Adobe Acrobat Sign.
• A small practice's intake and consent forms: Jotform Sign. Patient paperwork usually starts as a form, and Jotform puts its HIPAA features and BAA on the Gold plan rather than behind an enterprise contract. Skip it if the documents are contracts drafted elsewhere rather than forms.
• Who should skip Dropbox Sign for PHI: a small practice. Its HIPAA mode requires an annual plan and a minimum contract value, and it switches off features many teams rely on.

Before you send the first patient form

1. Get the BAA signed, and check that it names the product and plan you actually use.
2. Turn on the vendor's HIPAA mode, if it has one, before uploading anything.
3. For Part 11, write your validation plan and the certification letter before go-live, not after an inspection asks for them.
4. For the general question of whether an e-signature holds at all, see are electronic signatures legally binding.